Dual System Encryption:Realizing IBE and HIBE from Simple Assumptions

Brent Waters

2

Identity-Based Encryption [S84,BF01,C01]

Public ParamsMSK

ID’

ID

Authority

Decrypt iff ID’ = ID

IBE Security [BF01]

Challenger

M0, M1, ID* IDi (challenge ID)

AttackerPublic ParamsID1

ID1…IDQ

IDQ

b Enc(Mb , PP, ID*)b’

Adv = Pr[b’=b] -1/2

IBE Security Proofs

“Partitioning” [BF01, C01, CHK03, BB04, W05]

Simulator

Challenge Space

ID Space

Priv. Key Space

2 Goals:Answer Attacker QueriesUse Attacker Response

Attacker

Partitioning and Aborts

SimulatorID Space

Priv. Key Space Challenge

Space

ID1

ID2……IDQ

ID* (challenge ID)

Attacker

Abort andtry again

Finding a Balance

Simulator

Challenge Space

ID Space

Priv. Key Space

Aborts effect security loss Challenge Space -> “right size”C.S. = 1/Q (for Q queries ) => 1/Q no abort

Structure gives problems!Hierarchical IBE Q queries per HIBE level => (1/Q)depth lossAttribute-Based Encryption similar

:edu:gov

Partitioning won’t work!

The Gentry Approach [G06,GH09]

Ready for bothShove degree Q poly into Short params =>

Complex Assumption

Our ResultsIBE (w/ short parameters) HIBEBroadcast Encryption

Full Security Simple Assumption: Decision LinearGiven: g, u, v, ga , ub, Dist: va+b from R

Dual System Encryption2 types of Keys & CTs

IDNormal

IDSemi-Functional

ID

Normal Semi-FunctionalUsed in real system

ID

Types are indist. (with a caveat)

Principles

Simulator

No aborts

Change things slowlyHybrid over keys formGoal: Everything Semi Functional

I’m ready for anything!

Proof Overview – 3 Steps

Simulator

1) Challenge CT Semi Func.2) Keys Semi. Func. (one at a time!!)

3) Argue SecurityID1

ID2

…

IDQ

ID*ID1

ID2

IDQ

ID

Problem: Simulator can test keys!

Simulator

Create S.F. CT for “Bob” and unknown key for “Bob”Decryption works iff key is normal

“Bob”

?

“Bob”

Resolution: Tweak SemanticsAdd “tags” tc , tk to C.T. and KeyDecrypt iff IDc = IDk AND tc tk Negl. correctness error (can patch)SW08 revocation

IDc , tc IDK , tK

Problem: Simulator can test keys!

Simulator

Sim. Picks A, B 2 Zp : F(ID) = A ¢ ID + BChallenge CT and unknown key tags F(ID)

“Bob” , tk =x

?

“Bob” , tc =x

Dec. Fails regardless of Semi Functionality!2 different IDs look independentHybrid simple assumption

How it is builtSubgroup version N= p1 p2 p3

IDNormal

ID

IDNormal

S.F.

IDS.F.

p2p1 p3

Glimpse of Subgroup ConstructionSetup:

Similarities to Boneh-Boyen04D. Linear same concepts, more messy

KeyGen(ID):

Encrypt(ID,M):

Conclusions and SpeculationDual Encryption: Change Forms First!

One by one Small Assumptions HIBE, B.E. became easier

Prediction: ABE + Functional Enc. Need new techniques

Prediction: Simple Assumptions & Full Security

Dual Interpretation

Selective Security + Assumptions were bad

Not ultimately necessary

Interpretation 1:

They lead us in the right directionsFull secure schemes “look like” selectiveGentry06 beyond partitioning

Alternative:

20

Thank you

The Gentry Approach [G06,GH09]

Ready for bothSimulator 1-key per identity – always looks goodShove degree Q poly into Short params =>

Complex Assumption